diff options
| author | ZyX <kp-pav@yandex.ru> | 2017-07-04 15:41:59 +0300 |
|---|---|---|
| committer | ZyX <kp-pav@yandex.ru> | 2017-07-04 15:41:59 +0300 |
| commit | 91b9ad7d8294532939db51db1045605abfff49c2 (patch) | |
| tree | 1479be19fed3a5db4f635dca7e7ba5d25ac9ccab /src | |
| parent | 008b604bacbbeeaf0e04f94b1d331b11ebec631a (diff) | |
| download | rneovim-91b9ad7d8294532939db51db1045605abfff49c2.tar.gz rneovim-91b9ad7d8294532939db51db1045605abfff49c2.tar.bz2 rneovim-91b9ad7d8294532939db51db1045605abfff49c2.zip | |
shada: Make sure that code does not attempt to read too long items
Fixes #6957
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/shada.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/nvim/shada.c b/src/nvim/shada.c index 4788b1e7d0..728a3f65be 100644 --- a/src/nvim/shada.c +++ b/src/nvim/shada.c @@ -3413,7 +3413,15 @@ shada_read_next_item_start: return mru_ret; } - const size_t length = (size_t) length_u64; + if (length_u64 > PTRDIFF_MAX) { + emsgf(_(RCERR "Error while reading ShaDa file: " + "there is an item at position %" PRIu64 " " + "that is stated to be too long"), + initial_fpos); + return kSDReadStatusNotShaDa; + } + + const size_t length = (size_t)length_u64; entry->timestamp = (Timestamp) timestamp_u64; if (type_u64 == 0) { |